A follow-up to: Manual Web App Security Checks Don't Scale: Inside Our Automated Assessment & Remediation Framework
About a month and a half ago I described what StackSentry really does, that there could be a security scanner which finds not only the issues of your web application stack but also asks what is the exact fix step by step, grading you after fixing, etc.
The previous post was an insight. Here is the new post which is very short it is out there.
pip install stacksentry
stacksentry -t https://your-app.com --mode full
That is it. No agent. No account. No API key required.
What changed since the first post
The framework for scanning and prioritisation was the main content of the first post. After that, the following four major features were brought in:
- Auto-fix. StackSentry is capable of directly implementing changes such as nginx security headers, HSTS, TLS hardening, SSH hardening, Dockerfile modifications, docker-compose resource limits all either through SSH or directly on your configuration files. It is not simply telling you what to fix, but actually fixing it.
- SSH key safety. StackSentry creates an SSH key pair, installs it on your server, tests the key login, and only after this does it change the sshd settings when it applies
PermitRootLogin prohibit-password. You can't lock yourself out.
- PHP and shared hosting support. The tool can identify PHP/Apache stacks by looking at URL patterns and response headers even if the server doesn't respond. Also, your admin paths can now be extended to include /phpmyadmin, /pma, /cpanel. Instead of Flask, patch templates produce Laravel and vanilla PHP code.
- Dry-run mode.
--fix --dry-runwill present the full plan all the SSH commands that would be executed, the key migration warning, the exact nginx snippets before one single byte changes on your server.
Proof it works
Here is what happened when I ran StackSentry against my own production VPS:
| Before | After | |
|---|---|---|
| Grade | F (16.7%) | C (72.7%) |
| Attack paths | 1 | 0 |
| High risk issues | 5 | 1 |
With just a single command, six checks reversed from FAIL to PASS. The leftover failures are all related to code-level security, e.g., CSRF middleware, cookie flags, rate limiting. StackSentry is pretty accurate at highlighting them as manual with framework-specific copy-paste snippets.
What we need from you
StackSentry has been tested against three live applications. That is not enough. We need people to run it against real stacks, different hosting setups, different server configurations, different frameworks.
Specifically, we are looking for feedback on five things:
- Does the scan accurately reflect your real security posture? If a check passes when it should fail, or fails when it should pass, that is the most important thing to know.
- Does auto-fix break anything? Run
--fix --dry-runfirst, review the plan, then apply. If something goes wrong, open an issue with the verbose output (-v).
- Is the grade meaningful? Does F feel like F on your server? Does C feel like C after fixes?
- PHP and shared hosting users especially welcome. This is the area with the least testing. Scan a WordPress site, a cPanel server, a plain PHP app.
- Does the PDF report make sense to someone who did not run the scan? Hand it to a colleague and ask them what they would fix first.
How to get started
# Install
pip install stacksentry
# Quick HTTP scan — no SSH needed
stacksentry -t https://your-app.com
# Full scan with SSH — see host layer checks
stacksentry -t https://your-app.com --mode full \
--ssh-host YOUR_IP --ssh-user root --ssh-password yourpass \
-o report.pdf
# Always dry-run before applying fixes
stacksentry -t https://your-app.com --mode full --fix --dry-run \
--ssh-host YOUR_IP --ssh-user root --ssh-password yourpass
The full CLI reference, auto-fix coverage table, and SSH key safety documentation are in the README on GitHub.
One ask
If you try it — whether it works perfectly, partially, or breaks entirely. Open an issue or leave a comment here. Every piece of feedback directly shapes what goes into Phase 5.
And if the tool is useful, a ⭐ on GitHub helps it reach more people who have the same 40-item findings list and no idea where to start.
Built during MSc Computer Science at London Metropolitan University.
Phase 4 complete. 321 tests passing. Phases 1–4: scan → prioritise → simulate → auto-fix.
Comments